{"id":"462400e3-3703-469f-b6af-c05aa7c6c92d","arxiv_id":"2507.00690","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"CageAttack generates adversarial point clouds by perturbing cage vertices and propagating deformations via mean value coordinates, claiming a better trade-off between attack success, transferability, undefendability, and plausibility.","lead":"This paper introduces CageAttack, an adversarial attack on 3D point cloud classifiers that deforms an object by moving the vertices of a surrounding 'cage' rather than moving individual points. The authors claim this produces more natural-looking adversarial examples that still transfer across models and resist defenses.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Plausibility claim rests on unvalidated geometric metrics and a 10-person preference study with no original-cloud baseline; without perceptual validation, the central balance claim lacks support.","rationale":"The reader identified the plausibility-metric proxy as the weakest assumption. I agree; the paper's novelty is natural deformation, so if plausibility is not measured validly, the central contribution collapses. The user study is present but too small and lacks an original baseline, so it does not settle the issue. The cage-validity gap is a related but secondary technical risk. Because these concerns are addressable with additional experiments (larger user study, metric correlation, cage validity checks) and do not demonstrate a known erroneous result, the CONDITIONAL verdict remains appropriate.","tokens_in":19995,"tokens_out":8527,"duration_ms":99838,"concrete_test":"Perform a two-alternative forced-choice user study with at least 50 participants on 100 samples per condition, comparing CageAttack adversarial point clouds against the original point cloud (and against a matched-distortion baseline). Also compute, per sample, Spearman correlations between each of the five geometric metrics and human naturalness ratings. If CageAttack outputs are not significantly preferred over originals (or the metrics do not correlate with ratings), the plausibility claim fails. In parallel, instrument the cage optimizer to record the fraction of points with negative mean-value coordinates or cages with self-intersections; if this fraction is non-negligible, the deformation pipeline needs a validity constraint.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim (abstract, Sec. V.B) is that CageAttack 'achieves a superior balance among transferability, undefendability, and plausibility.' The plausibility leg rests on five geometric metrics (CSD, Curv, Uni, KNN, Lap) reported in Tab. I and a user study (Tab. V) in which 10 participants chose the 'most plausible' adversarial cloud among five methods across 100 samples. This design does not establish absolute plausibility: the original cloud is not included as a baseline, so a deformed cloud can win by being merely the least distorted among poor options. The metrics are also used without definitions or any evidence that they track human judgments; no correlation or per-sample analysis is given. If, for example, a cage deformation that globally shrinks an object achieves low curvature/Laplacian values while being clearly unnatural to humans, the headline advantage would evaporate. A secondary gap is that the cage construction and vertex optimization (Sec. IV.A) impose no explicit requirement that the optimized cage remain non-self-intersecting or that all points remain strictly inside the cage; mean value coordinates (Eq. 4) are assumed valid, but no failure analysis is provided. These gaps make the 'natural deformation' claim under-supported, and without it the 'superior balance' conclusion does not follow from the reported tables.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces CageAttack, a deformation-based adversarial attack for 3D point clouds. A cage enclosing the input cloud is constructed via curvature- and density-aware subdivision and vertex optimization; the attacker then perturbs cage vertices, and mean value coordinates propagate the deformation to the cloud. The attack is evaluated on ModelNet40, ScanObjectNN, and ShapeNet Part against six (abstract says seven) classifiers, with comparisons to nine baselines on attack success, transferability, robustness to four defenses, and five geometric naturalness metrics, plus ablations, a 10-participant user study, and a physical 3D-printing experiment. The central claim is that CageAttack achieves a superior balance of transferability, undefendability, and plausibility.","tokens_in":20246,"tokens_out":4726,"duration_ms":51688,"significance":"The proposed use of a cage as a structured deformation handle is a novel and sensible idea for point-cloud attacks; if the plausibility claim holds, the method is a useful contribution. The paper's experimental breadth is a strength: three datasets, multiple architectures, nine baselines, four defenses, ablations of the cage-construction stages, and a physical attack attempt. The code-release statement and the ablation study (Tab. IV) are also positive. However, the plausibility leg of the central claim is currently under-supported, and several load-bearing claims need better evidence.","major_comments":[{"comment":"The five naturalness metrics (CSD, Curv, Uni, KNN, Lap) are not defined in the paper and are never validated against human judgments, yet the user study in Tab. V uses only 10 participants, does not include the original clean cloud as a baseline, and asks participants to pick the 'most plausible' among five attack outputs. This design at best shows relative plausibility among a flawed set and cannot establish the absolute claim that CageAttack deformations are natural. I ask the authors to include the original cloud as a control, report pairwise preference counts and inter-rater agreement, and provide a per-sample correlation between the geometric metrics and human ratings.","section":"§V.A, Tab. V"},{"comment":"The physical attack experiment is reported only as 'some samples successfully fool the model,' with no success rate, sample size, or quantitative comparison before/after 3D printing and re-scanning. Because the physical-domain claim is part of the paper's motivation, this section should report the number of trials, the attack success rate, and ideally per-sample geometric deviation introduced by fabrication.","section":"§V.C"},{"comment":"The cage construction and vertex optimization do not enforce that the cage remains non-self-intersecting or that all points stay inside the cage; mean value coordinates (Eq. 4) are well-defined for closed cages but can be negative for exterior points, and Eq. (6) assumes the coordinates remain valid. The paper provides no failure analysis or statistics on how often the optimization produces a degenerate cage for the 1,024-point inputs. Please add explicit constraints or report the incidence of invalid/degenerate cages and how such cases are handled.","section":"§IV.A, Eq. (8)"},{"comment":"All reported ASR and naturalness values are point estimates without error bars, number of repetitions, or significance tests. Several differences between CageAttack and the closest baselines are small (for example, the DGCNN ShapeNet Part Curv values tie at 6.920 in Tab. I), so the 'superior balance' conclusion needs variance information or a statistical comparison to be robust.","section":"Tabs. I–III"}],"minor_comments":[{"comment":"The abstract states that experiments cover 'seven 3D deep neural network classifiers,' but Section V.A lists six (PointNet, PointNet++, DGCNN, PointMLP, PCT, Mamba3D); please correct this inconsistency.","section":"Abstract vs. V.A"},{"comment":"The five naturalness metrics are called 'widely recognized' but are not defined; Curv has no citation, and CSD, Uni, KNN, and Lap only have references. Please give definitions or precise formulas so the reader can interpret the magnitudes in Tab. I.","section":"§V.A"},{"comment":"The subdivision criterion uses Scur and Sden, but the paper only describes them verbally as 'average curvature' and 'density' of points in a tetrahedron; specify how these are computed and normalized.","section":"Eq. (7)"},{"comment":"The trade-off plots show 'ASR vs. KNN,' but the axes, the plotted curves, and how the Pareto frontier is determined are not explained; please add labels and a caption that defines the metric on the y-axis.","section":"Fig. 3"},{"comment":"The phrase 'remain hidden in the human psyche' is informal and unclear; rephrase to describe human perceptibility.","section":"Fig. 1 caption"},{"comment":"The user study description does not state whether each participant rated all 100 samples, what instructions were given, or how ties were handled; please provide the protocol and inter-rater agreement.","section":"Tab. V"}],"recommendation":"major_revision","confidential_remarks":"The manuscript is within the scope of the journal and the core idea is interesting. My main concern is overclaiming plausibility; if the authors add perceptual validation and quantify physical attacks, it could become acceptable. I would not reject on the basis of disagreement with consensus."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"You should know two things about arXiv:2507.00690. The first is that it is a genuine new application: I am not aware of a prior point cloud attack that builds a cage around the object and deforms via mean value coordinates. The second is that its central \"superior balance\" claim is only half-supported. The attack-effectiveness side is solid; the plausibility side is shaky.\n\nWhat the paper does well: it takes an established graphics tool and uses it in a sensible way. Cage construction with curvature/density-aware subdivision and vertex optimization is a reasonable pipeline, and the ablation (Tab. IV) shows both components matter. The empirical comparison is broad: three datasets, six classifiers, nine baselines, four defenses. CageAttack consistently reaches ~100% ASR while posting the lowest or near-lowest values on all five naturalness metrics, and its transferability numbers (Tab. II) are strong for PointNet and DGCNN sources. The physical 3D-printing demo, though qualitative, shows the idea works outside simulation. I also want to credit the authors for not over-fitting: the attack loss in Eq. (9) contains misclassification plus Chamfer distance, not the naturalness metrics, so the low distortion values are not merely a circular artifact.\n\nThe soft spots are real but not fatal. The plausibility claim leans entirely on five geometric metrics whose definitions are not given in the paper and which are never validated against human judgment. The user study has 10 participants, 100 samples, and no original-cloud baseline, so \"most plausible\" could just mean \"least distorted among poor options.\" The parameter analysis (Fig. 7) effectively tunes the method on those same metrics, which inflates confidence. There are also no error bars or significance tests anywhere. Minor issues: the abstract promises seven classifiers but the experiments use six; the code is not released; and the paper never analyzes whether the optimized cage can self-intersect or push points outside the cage, which matters for the validity of the mean value coordinates.\n\nIf a referee focuses on the attack and transferability results, the paper holds up. If they focus on \"plausibility\" as a headline contribution, it needs more work. I would accept this for peer review: the new method, the breadth of experiments, and the honest (if incomplete) comparison deserve referee time. But I would ask the authors to release code, add error bars, define the metrics, and run a proper perceptual study that includes the original cloud. My guess is that CageAttack is genuinely better than the baselines on naturalness; the paper just hasn't proven it yet.","headline":"CageAttack is a real new attack with broad experiments, but its 'superior plausibility' claim rests on unvalidated metrics and a 10-person study.","tokens_in":20797,"tokens_out":2980,"would_cite":true,"duration_ms":34576,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Attacking a 3D point cloud by deforming an enclosing cage, rather than moving points directly, yields adversarial shapes that look natural and still transfer across classifiers and resist defenses.","keywords":["adversarial attacks","point clouds","cage-based deformation","transferability","undefendability","plausibility","mean value coordinates","3D deep learning"],"falsifier":"Run a large, preregistered forced-choice user study comparing CageAttack outputs with HiT-ADV and Mani-ADV outputs at matched attack success rates, using a diverse pool of raters; if human raters do not systematically prefer CageAttack's shapes as the most natural, the paper's central balance claim is falsified.","tokens_in":19772,"feed_emoji":"🎯","tokens_out":8941,"duration_ms":87035,"temperature":0.7,"pith_summary":"The paper proposes CageAttack, a method for generating adversarial point clouds that mislead 3D deep learning classifiers while remaining plausible to human observers. The central claim is that perturbing an enclosing cage, rather than individual points, produces smooth, natural-looking deformations that keep attack success high while improving transferability across models and resistance to defenses. The authors argue that existing deformation attacks either impose rigid imperceptibility constraints that limit transferability or produce unstructured distortions that are visually conspicuous. CageAttack's cage construction—subdivision driven by curvature and density, followed by vertex optimization—provides a structured, shape-aware control basis for the deformation. If the claim holds, adversarial point cloud attacks can be both effective and perceptually inconspicuous without sacrificing generalization or robustness.","feed_headline":"Perturb the cage, not the points: natural 3D adversarial shapes","feed_subtitle":"Deforming an enclosing cage keeps adversarial point clouds looking natural while staying transferable and undefendable.","key_machinery":"The cage is the central object: a closed triangular mesh enclosing the point cloud, refined by subdividing tetrahedra based on point-cloud curvature and density and then optimizing vertex positions to conform to the surface while keeping faces smooth and evenly sized. The point cloud is expressed as convex combinations of cage vertices via mean value coordinates, so perturbing cage vertices is a structured, low-dimensional handle on the whole shape. The optimization objective is misclassification loss plus a Chamfer-distance imperceptibility penalty between the original and deformed point clouds, solved in the style of the optimization attack the paper builds on. The cage's structure carries the argument: it globalizes the deformation, prevents pointwise outliers, and keeps changes intrinsic to the object's geometry.","core_discovery":"The discovery is that cage-based deformation yields a better balance among transferability, undefendability, and plausibility for adversarial point cloud attacks. Instead of moving points directly, the method fits a cage around the object, refines it via curvature- and density-aware subdivision and vertex optimization, and then perturbs cage vertices through an optimization that minimizes misclassification plus a Chamfer-distance penalty. Perturbations propagate to the point cloud through mean value coordinates, so the deformation remains smooth and intrinsic to the shape. On seven classifiers across three datasets, CageAttack reaches near-100 percent attack success while scoring lowest or near-lowest on five naturalness metrics (CSD, curvature, uniformity, KNN distance, Laplacian loss) among deformation methods, and it keeps competitive transferability and undefendability, particularly surviving the strong IF-Defense with substantially higher success than most baselines.","pith_inferences":["If the naturalness metrics are trusted, the cage idea could transfer to other geometry-processing tasks, such as adversarial attacks on meshes or implicit surfaces, where a structured deformation handle is equally available.","Because the cage provides a low-dimensional control space, CageAttack could serve as a probe for studying the geometry of adversarial directions in shape space, where each perturbation corresponds to a coherent geometric change rather than independent point motion.","A testable extension would be to analyze how cage fitting error—especially for concave or complex objects—affects the smoothness guarantee; the paper does not provide such analysis, and the method's reliance on an enclosing sphere suggests this is the key boundary condition.","One could check whether the transferability gain comes from the cage's smoothness or simply from larger overall deformation magnitude, by matching displacement magnitudes across attacks; the paper does not isolate this."],"forward_implications":["A deformation-based attack can reach near-maximal attack success while scoring lower on five geometric naturalness metrics than nine baseline methods, including other deformation attacks.","CageAttack maintains competitive transferability across model pairs, with success rates up to roughly 85 percent in some settings, while preserving much higher perceptual quality than the most transferable baselines.","Against the strong IF-Defense defense, CageAttack keeps attack success above 25 percent across victim models, whereas most non-deformation attacks fall to well below that.","The method carries over to physical attacks: reconstructed, 3D-printed, and re-scanned adversarial objects still fool the victim model on some samples.","Cage subdivision and vertex optimization are necessary components: ablations show skipping either one degrades naturalness metrics and attack success."],"supporting_citations":[{"why":"Establishes the basic point-cloud adversarial attack framework, 3D-ADV, whose formulation and dataset settings this paper follows.","marker":"[3]"},{"why":"Mani-ADV is the main deformation-based baseline; its parameter-plane stretching is contrasted with CageAttack's structured cage.","marker":"[10]"},{"why":"HiT-ADV is the other deformation baseline, providing the CSD naturalness metric and the localized Gaussian-deformation comparison.","marker":"[11]"},{"why":"Supplies the optimization approach used to solve the cage perturbation problem.","marker":"[26]"},{"why":"KNN-ADV is a baseline and supplies the KNN distance naturalness metric.","marker":"[36]"},{"why":"MeshAttack is a baseline and the source of the Laplacian regularization term used in cage vertex optimization.","marker":"[37]"},{"why":"Provides the cage-based deformation method and its properties that justify smooth, natural deformation.","marker":"[63]"},{"why":"Mean value coordinates are the mapping that propagates cage vertex perturbations to the point cloud.","marker":"[64]"},{"why":"IF-Defense is the strongest defense baseline whose near-total suppression of most attacks highlights CageAttack's undefendability.","marker":"[69]"},{"why":"ModelNet40 is the main synthetic dataset used for training and evaluation.","marker":"[13]"}],"fun_headline_variants":["Deform a cage, not the points: natural transferable 3D attacks","CageAttack: natural adversarial shapes from cage-based deformation","Perturb cage vertices, not points: undefendable 3D attacks","Smooth cage deformation yields stealthy, transferable 3D attacks","Cage-based point cloud attack: natural, transferable, undefendable"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The central plausibility claim rests on five geometric smoothness metrics plus a small user study, and the deformation's smoothness is assumed to follow from a cage that fits the object closely enough; if those proxies do not track human perception, the advantage is unverified.","fun_headline_variants_meta":{"raw":{"variants":["Deform a cage, not the points: natural transferable 3D attacks","CageAttack: natural adversarial shapes from cage-based deformation","Perturb cage vertices, not points: undefendable 3D attacks","Smooth cage deformation yields stealthy, transferable 3D attacks","Cage-based point cloud attack: natural, transferable, undefendable"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000508,"raw_usage":{"total_tokens":2442,"prompt_tokens":881,"completion_tokens":1561,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":497,"completion_tokens_details":{"reasoning_tokens":1461}},"tokens_in":497,"tokens_out":1561,"duration_ms":13586,"temperature":1.0,"reasoning_tokens":1461,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T21:08:36.323315+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run a large, preregistered forced-choice user study comparing CageAttack outputs with HiT-ADV and Mani-ADV outputs at matched attack success rates, using a diverse pool of raters; if human raters do not systematically prefer CageAttack's shapes as the most natural, the paper's central balance claim is falsified.","supporting_citations":[{"cited_title":"Generating 3d adversarial point clouds,","cited_arxiv_id":null,"evidence_quote":"Establishes the basic point-cloud adversarial attack framework, 3D-ADV, whose formulation and dataset settings this paper follows."},{"cited_title":"Deep manifold attack on point clouds via parameter plane stretching,","cited_arxiv_id":null,"evidence_quote":"Mani-ADV is the main deformation-based baseline; its parameter-plane stretching is contrasted with CageAttack's structured cage."},{"cited_title":"Hide in thicket: Generating imperceptible and rational adversarial perturbations on 3d point clouds,","cited_arxiv_id":null,"evidence_quote":"HiT-ADV is the other deformation baseline, providing the CSD naturalness metric and the localized Gaussian-deformation comparison."},{"cited_title":"Towards evaluating the robustness of neural networks,","cited_arxiv_id":null,"evidence_quote":"Supplies the optimization approach used to solve the cage perturbation problem."},{"cited_title":"Robust adversarial objects against deep learning models,","cited_arxiv_id":null,"evidence_quote":"KNN-ADV is a baseline and supplies the KNN distance naturalness metric."},{"cited_title":"3d adversarial attacks beyond point cloud,","cited_arxiv_id":null,"evidence_quote":"MeshAttack is a baseline and the source of the Laplacian regularization term used in cage vertex optimization."},{"cited_title":"A survey on cage-based deformation of 3d models,","cited_arxiv_id":null,"evidence_quote":"Provides the cage-based deformation method and its properties that justify smooth, natural deformation."},{"cited_title":"Mean value coordinates for closed tri- angular meshes,","cited_arxiv_id":null,"evidence_quote":"Mean value coordinates are the mapping that propagates cage vertex perturbations to the point cloud."}],"review_version":1}